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Abstract. Spread of computer viruses can be modeled as the SIS (susceptible- infected-susceptible) epidemic 
propagation. We show that in order to ensure the random immunization or the targeted immunization 
effectively prevent computer viruses propagation on homogeneous networks, we should install antivirus 
programs in every computer node and frequently update those programs. This may produce large work 
and cost to install and update antivirus programs. Then we propose a new policy called "network monitors" 
to tackle this problem. In this policy, we only install and update antivirus programs for small number of 
computer nodes, namely the "network monitors". Further, the "network monitors" can monitor their 
neighboring nodes' behavior. This mechanism incur relative small cost to install and update antivirus 
programs. We also indicate that the policy of the "network monitors" is efficient to protect the network's 
safety. Numerical simulations confirm our analysis. 
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1 Introduction prevent epidemic propagation. It was confirmed by many 

studies [f ,2,3. However, on heterogeneous networks just 

One of key issues in the field of epidemiology is to ,., , c , OT ^-, , , , , . 

° like scale-tree (br ) networks, random immunization me- 

find effective strategies to prevent epidemic outbreaks. Re- ... , , a .. , . . , 

° chamcs is not particularly effective and we must mtro- 

searchers widely studied immunization strategies in the 3 , , n , , - J T j 

■' ° duce other strategies to fight against epidemic. In order to 

SIS (susccptiblc/infcctive/susceptible) model and the SIR , ,,. u-j.jjj.-i 
v ' it-/ solve tins problem, some researchers introduced optimal 

(susceptible /infective /removed) model. On some homoge- . . , . , . , , i i • 

v ' ' ' ° immunization strategies sucn as the targeted mimumza- 

neous networks, random immunization can be applied to , , , , , , , 

tion strategy and the acquaintance immunization strategy. 
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Relevant studies showed that these immunization strate- geneous networks, the random immunization strategy and 

gies are efficient on SF networks [SJGIH]. the targeted immunization strategy may fail to prevent 

T-, ,, , , TTT n OTO , , virus propagation. Then, we introduce "network monitor" 

For the computer network, We often use the SIS modei r r o 

, i t strategy to protect computer network's safety and analyze 

to describe computer viruses spreading on networks. In OJ r * J J 

, , , . . .. , , , its efficiency on homogeneous networks. In section 51 we 

addition, reievant immunization strategies can be appfied jo <—• 

, j- T concentrate on the issue of the effectiveness of the "net- 

to this model to prevent computer viruses spreading. In 

,i. . , work monitor" strategy on SF networks. Finally, we give 

this case, the situation that some computer recovers and bJ J ' ° 

, , , m , , , , j, i -i discussion and conclusions, 

returns to trie susceptible state can be regarded as the 

fact that there is antivirus software in a computer node 

and the computer can be "cured" by this software if it is 2 Eradicating epidemics On homogeneous 

infected by computer viruses. However, if we want rel- 

networks 

evant immunization strategies such as the random im- 

munization and the targeted immunization to be effec- There are twQ dagsic wayg tQ deal with problems of the 

tive on homogeneous networks, we must install antivirus epidemic propagation. One way is based on the percolation 

programs in each computer nodes and frequently update theory and techniques of generating functions HUH]. In 

those antivirus programs. Otherwise, random immuniza- ^ in the gtudy of the resil i e nce of the network EIUDHUl 

tion and targeted immunization may fail to prevent com- 12 this method was also widely used The other way is 

puter viruses propagation. As a result, it may produces baged Qn mean _ ncld theory In this paperj we mainly use 

large costs to install and update antivirus programs for mean _ field theory for ana i ysis . 

each computer and sometimes installing and frequently P . , , , , , . a 

1 o i j _t irst, we snow that random immunization is not ettec- 

updating every computer's antivirus programs is even im- . . . r 

1 ° ■' 1 t- o £ lve ^ preven t computer viruses propagation it we cannot 

possible. For instance, the university cannot ensure every . , „ , , , , . . r , 

install and update antivirus programs tor each computer 

student's computer or notebook in the campus network , , T OTC , , , , 

1 ^ nodes m the network. In the SIS model, computer nodes 

possesses antivirus software. Consequently, it is meaning- , - c , , , , , . r . • j 

^ are classified as susceptible nodes and infective nodes. 

ful to find other efficient schemes that incurs relatively ^ , , ., , , . . r , , .,, > . , , 

J Fach susceptible node is infected with rate A provided that 

low costs to install and update antivirus programs. In this ., . , , . c .. , ,, r . tl 

* ° it is connected with one or more infective nodes. Without 

paper, we concentrate on this issue. , r ,., n , . <■ j 

^ * ' loss of generality, we also assume that miective nodes are 

The paper is organized into following sections. In sec- cured and become susceptible nodes with rate 1. Here, 

tionEJ we show that if we cannot install and frequently up- infective nodes are "cured" by antivirus programs. For 

date antivirus programs for every computer on the homo- simplicity, we concentrate on the WS network |13j with 
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rewire probability 1, which has similar degree distribution If we apply random immunization, we can simply replace 

with the ER random graph model |14] and can be viewed A by A(l — g) where g represents the immunity. Then the 

as a homogeneous network. Then the differential equation following differential equation can be obtained: 
of the SIS model is as follows: j r,\ 

^l = \(l-g)(k)p(t)[l-p(t)] (3) 

= X(k)p(t)[l - p(t)] - p{t) (1) After imposing the stationary condition ^ = 0, we 

have: 

Here, pit) represents the density of infected nodes, (k) is 

X(l-g)(k)p(t)[l-p(t)]=0 (4) 

the average degree of a homogeneous network and A is the 

spreading rate. Suppose we can only install and update The critical immunization can be obtained by letting Eq. (4) 

antivirus programs for a (0 < a « 1) computer nodes onl y has one solution p{t) = 0. It can be fulfilled by forc- 

(q is the fraction of computer nodes). Then 1 - a com- in § A = where A ^presents the discriminant of Eq. (4). 

puter nodes cannot recover when they become infective. So the critical immunization g c = 1 when A ^ 0. It shows 

In this case, Eq. (1) is not appropriate to describe prop- that random immunization is not effective, 
agation behavior. The reason is as follows: the density of We also conduct numerical simulation to test effcctive- 

p(t) is somewhat random density, then they may belong to ness 01 the random immunization strategy. Besides ran- 

all I - a computer nodes, which means that they cannot dom immunization, we also test the effectiveness of the 

recover again. As a result, the second item on the right targeted immunization on the WS network. The result can 

of Eq. (I) is invalid. If I - a vertices on the network can- be seen in Fi gHJ In Fi gl2 ( a )> the data of circles represent 

not recover after they become infective, it is better to use the effectiveness of the random immunization. It can be 

SI (susceptible/infective) model to describe virus propa- observed that nearly 0.8 computer nodes should be im- 

gation behavior among those I - a vertices. Without loss munized in order to prevent the epidemic propagation. In 

of generality, we assume those a nodes are randomly cho- Fi gl2 ( b )> the data of circles represent the effectiveness of 

sen from the WS network or the random network. Then the targeted immunization on the WS network. We should 

the subnetwork with I - a nodes is also random network. sti11 immunize nearly the fraction of 0.65 nodes to prevent 

Thus, we can just consider the effectiveness of random virus propagation, which means targeted immunization is 

immunization with the SI model on the WS network with s **^ n °t efficient. 

rewire probability 1. The differential equation of the SI Consequently, if we want to efficiently prevent corn- 
model is as follows' puter virus propagation on homogeneous networks, we 

should install and update antivirus programs for each com- 

~j7 " = Mtyp(t)[l ~ (2) puter nodes on the network. Then the propagation behav- 
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ior can be described by the SIS model. Relevant studies can obtain the following quadratic equation of p(t) : 

indicated that random immunization and targeted immu- Wl WI , ,.^n , rj ., /JN \ W1 w ,,i r.\ ^ ,n\ 

A(l -g)(k)p{t) + [f{(k),g)-\{l-g)(k)]p{t)=0 (6) 

nization are effective in this case [5] .However, it can pro- 

p(t) = is the solution of Eq. (6). If we want Eq. (6) to 

duce large cost and work to install and update antivirus 

only have this trivial solution, we need A = 0. Then we 

programs. In order to avoid this problem, we introduce a 

can get the critical density: 

new mechanism that can incur relatively small cost. We 



A/(A + 1) f((k},g c ) = (k}g c 

l-l/(A<fc» f((k),g c ) = l 
So we can conclude that our random "network monitors" 



call this new mechanism "network monitors" . Specifically, 
we introduce two type "network monitors" . One is the 
random "network monitors" and the other is the targeted 
"network monitors" . The implementation of the random 

can successfully suppress the epidemic outbreaks. 

"network monitors" is as follows: we randomly select some 

We also introduce the targeted "network monitors" . In 

nodes on the network as "network monitors" . These nodes 

this mechanism, we choose those computer nodes with the 

play two roles. On the one hand, they are immunized 

highest degree as "network monitors" . In order to test the 

nodes. In other words, we always update new version an- 

effectiveness of the targeted "network monitors" , we per- 

tivirus programs and fire walls in "network monitors" . So 

form numerical simulations. Further, we also use numeri- 

they cannot be infected by viruses. On the other hand, 

cal simulation to test the random "network monitors" . 

"network monitors" can monitor their neighboring nodes. 

Our simulations are as follows. In random "network 

If they find their neighbors infected by computer viruses, 

monitors" , we randomly choose some node to be infective 

they can "help" infected neighbors recover to the suscep- 

individual and randomly select nodes with density g as 

tible nodes. In analysis, we assume that each susceptible 

"network monitors" . Then, if an infective node connects 

node is infected with rate A and the infective nodes can 

to susceptible nodes, it infects each node with the rate A. 

recover only by the help of "network monitors" . 

As well, if an infective node is connected to one or more 

Now, we analyze the efficiency of random "network 

"network monitors" , the infective node recovers to the sus- 

monitors" . Here, we use g to represent the density of "net- 

ceptible node. Finally, when the density of infective nodes 

work monitors" . Then we have the following mean-field 

does not change, our experiment ends. In the simulation 

equation for the random "network monitors" : 

of the targeted "network monitors", the only difference 
— A(l g)(k)p(t)[l p(t)] f((k),g)p(t) (5) f r0 m the random "network monitors" is that we initially 

In Eq. (5), f((k),g) =min(I, (k)g) is the probability that choose nodes with the highest degree as "network moni- 
a given infected node connects with "network monitors" . tors" . We perform simulations with 1000 different starting 
After imposing the stationary condition dp(t)/dt = 0, we configurations and with at least 10 different realizations 
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of the network. Fig. [T] shows the result of our numerical 
simulations. 

In Fig[T] (a) , the data of diamonds represent the ran- 
dom "network monitors" . We observe that the critical den- 
sity value g is near 0.5 for the random "network monitors" . 
This confirms our analysis. Since we can get the critical 
density of random "network monitors" when (k) = 8 and 
A = 0.25 in analysis, which is g c = 1 — I/(A(fc)) = 0.5. 
In FigfT] (b), diamonds represent the data of the targeted 
"network monitors", we observe that the targeted "net- 
work monitors" is still effective on the WS model. 

3 Eradicating epidemics on SF networks 

In this section, we focus on heterogeneous networks 
especially on SF networks (we do not consider degree cor- 
relations here). Firstly, we test whether the random "net- 
work monitors" is effective or not on SF networks. We 
write the mean-held rate equation as: 



dt 



A(l - g)k{l - Pk (t))6(t) - f(k,g)p k (t) (7) 



Here, g represents the density of "network monitors" and 
the function f(k,g) can be written as f{k,g) =min(l,A; 

^2k'p{k')gk> / (k)), which is the probability that an in- 

fc' 

fected node with k links connects with some "network 
monitor" . In addition, p k (t) represents the density of in- 
fected nodes that have degree k and we define the quan- 
tity 0{t) — kpkPk{t) I X) s Ps as t ne probability of the 

fc s 

susceptible node pointing to an infected node at time t. 
In Eq. (7), we observe that if we can keep f(k,g) = 1, 
then the random "network monitors" is most efficient. It 
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(a) 




(1)) 

Fig. 1. The relation of p g /po and density g on the WS model 
with N = 10 4 , (fc) = 8, P = 1, A = 0.25 (a) circles rep- 
resent the random immunization and diamonds represent the 
random "network monitors" , (b) circles represent the targeted 
immunization and diamonds represent the targeted "network 
monitors" . 

is apparent that if above condition is fulfilled, the effect 
of random "network monitors" is equivalent to the effect 
of random immunization strategy in the SIS model. From 
Ref. [2] we know that this immunization strategy is not 
particularly effective on SF networks in the SIS model. 
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As a consequence, random "network monitors" is also not F(0) — 0. Consequently, if there is a 6 (0, 1) that sat- 

effective on SF networks. isfies F(0) = 0, F'(0) > 0. It is equivalent to say that if 

Next, we investigate whether the targeted "network there is a non-zero solution of Eq. (10), then: 

monitors" is effective or not on SF networks. After ap- j i w;/o 

plying the targeted "network monitors", we obtain the ULy W k j \.K,yj -r 

following mean- field equation: So we can get Eq. (12): 

^ = Xk(l- Pk (t)- 9k )e(t)-m 9 ) Pk (t) (8) Al ^rr^ ^ ( 12 ) 

In Eq. (8), gr fe represents the density of "network monitors" H ere g c represents critical density of "network monitors" . 

with degree k and the function f(k,g) can be written as We define a new quant it y k t . When k > k t the density of 

f(k,g) =min(l, kJ2 k'p(k')g k , /(k)). Here we assume that " ne twork monitors" g k = 1 and when k < k t the density 

k' 

after applying the targeted "network monitors" , the prob- of » netw ork monitors" g k = 0. So we rewrite Eq. (12) as 

ability that a node with k links is healthy is (1— p k (t) — g k ). follows - 

In the stationary state (dp k (t)/dt = 0) we obtain Eq. (9) k 2 p(k) _ 

(k)^ o mg c )~ { } 

fromEq.(8): 

From the definition of k t we can get g c = ^ p{k) ~ 

fc>fc f 

Xk{\ -p k - g k )0 = f{k, g)p k (9) 1 _ p ^)dk. Then we can obtain the expression of k t 

_ „ ,_ s ,. , ,. . . ,, as a function of q c . Finally, we insert this expression into 
Irom Eq. (9) we can get the solution of p k (t) m the sta- 

iit \T.,r\\irni \ * . . — . \ t\ t Eq. (13) to get the critical density g c . 

tionary state: p k = ((1 - g k )Xk0)/(f(k,g) + Xk0). Now H v ' 6 J y 

,, . , , n ... r ^ , , . In order to support our analysis, we perform numerical 
inserting this result into the definition of 0, we can obtain 

„ simulations on the BA network 1171 with the network size 

Eq. (10): ' — ' 

N = 10 4 , mo = 7, m — 4 and A = 0.25. Initially, we infect 

e= 1 Tkv(k) ^ l ~9k)Xk0 

(k) ^ P{ ' f{k,g) + Xk0 K ' only one node. 

Here, we define an auxiliary function Fig. [2] shows the relation between reduced density of 

i n — WbD infected nodes p g /po hi the end and the density of "net- 

W k JV K '9) "T" AKC? work monitors" g. In Fig. [2J circles represent the data of 

It is apparent that F(0) = 0. Since ^2 kp(k) f^kg)+\ k % — ^ ne ran dom "network monitors" . We observe that the ran- 

k 

S kp(k) ^x' k k0 < ^' we nave ■P'(l) < 0- If -F'(O) < 0, dom "network monitors" is not particularly effective. We 

k 

then F(0) < for some £ (0,1]. But if F'(Q) > 0, should immunize large proportion of nodes as monitors 

there is a 0\ <G (0, 1) that satisfies F(0i) > 0. Then by to eradicate infection. On the contrary, we find that the 

the intermediate theorem, there is a € (6q, 1) satisfies targeted "network monitors" is effective. This fact can be 
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Fig. 2. The relation of p g /po and density g on the BA model 
with N = 10 4 , mo = 7, m = 4, A = 0.25. Circles represent the 
strategy of random "network monitors" and diamonds repre- 
sent the strategy of targeted "network monitors" . 

observed in Fig. [51 in which the critical density of "net- 
work monitors" g c rs 0.15. 

4 Discussion and conclusions 

The main conclusion can be summarized as follows: 

1. If we can only install and update the antivirus programs 
with the fraction a (0 < a << 1) computer nodes on the 
network, the random immunization and the targeted im- 
munization are not efficient to prevent computer viruses 
spreading on the homogeneous networks. 

2. We introduce a policy to protect the computer net- 
works, namely, "network monitors" . Specifically, we choose 
some computer nodes on the network as the "network 
monitors" . They play two roles. On the one hand, They 
are immune to computer viruses. On the other hand, "net- 
work monitors" can monitor their neighboring nodes' be- 
haviors. If they find their neighbors infected by computer 
viruses, they can eliminate computer viruses from infected 
neighbors. Based on different approach to select nodes as 
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the "network monitors" , we divide the "network moni- 
tors" into two types, one is the random "network moni- 
tors" and the other is the targeted "network monitors" . 
Through analysis, we find that the random "network mon- 
itors" and the targeted "network monitors" are effective 
on WS networks. Besides, the targeted "network moni- 
tors" is effective on SF networks. Numerical simulations 
confirm our analysis. 

In fact, our new strategy is similar with the contact 
tracing [18] but we explicitly set monitors on the network. 
If possible, we can initially install antivirus programs in 
each computer node on the network and then only up- 
date antivirus programs in "network monitors" . So the 
recovering probability of the infective computer node is 
generally not zero, since old version antivirus programs 
can "kill" ordinary viruses. Then the number of "network 
monitors" chosen to eradicate computer viruses is smaller 
than our analysis. It demonstrates that the strategy of the 
"network monitors" is practical and efficient that we need 
only update small fraction computers' antivirus programs 
and fire walls so that the security of the whole computer 
network can be kept. 

The author thanks Robert Ellis, Hemanshu Kaul and 
Michael Pelsmajer for meaningful comments. 
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